Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms

Abstract

Widespread and ever-increasing cybersecurity attacks against Internet of Things (IoT) systems are causing a wide range of problems for individuals and organizations. The IoT is self-configuring and open, making it vulnerable to insider and outsider attacks. In the IoT, devices are designed to self-configure, enabling them to connect to networks autonomously without extensive manual configuration. By using various protocols, technologies, and automated processes, self-configuring IoT devices are able to seamlessly connect to networks, discover services, and adapt their configurations without requiring manual intervention or setup. Users’ security and privacy may be compromised by attackers seeking to obtain access to their personal information, create monetary losses, and spy on them. A Denial of Service (DoS) attack is one of the most devastating attacks against IoT systems because it prevents legitimate users from accessing services. A cyberattack of this type can significantly damage IoT services and smart environment applications in an IoT network. As a result, securing IoT systems has become an increasingly significant concern. Therefore, in this study, we propose an IDS defense mechanism to improve the security of IoT networks against DoS attacks using anomaly detection and machine learning (ML). Anomaly detection is used in the proposed IDS to continuously monitor network traffic for deviations from normal profiles. For that purpose, we used four types of supervised classifier algorithms, namely, Decision Tree (DT), Random Forest (RF), K Nearest Neighbor (kNN), and Support Vector Machine (SVM). In addition, we utilized two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA) and compared their performances. We also utilized the IoTID20 dataset, one of the most recent for detecting anomalous activity in IoT networks, to train our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by GA. However, other metrics, such as training and testing times, showed that DT was superior.

Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection—Current Research Trends

“…To improve cybersecurity in IoT systems, the study in [ 72 ] addresses how to use the IoTID20 dataset to identify and stop denial-of-service (DoS) assaults. To keep an eye out for DoS abnormalities in network data, the authors suggested implementing ML classification methods in an IDS.…”

Detection of DoS Attacks for IoT in Information-Centric Networks Using Machine Learning: Opportunities, Challenges, and Future Research Directions

“…KNN is valuable for classification as it does not assume underlying data distributions, making it a non-parametric and lazy learning algorithm. Non-parametric statistics operate under the assumption that there is no predefined data distribution [23]. In addition, the KNN algorithm takes as input the k-nearest training samples in the feature space.…”

“…The accuracy of this algorithm can be significantly enhanced by normalizing the training data [24]. Furthermore, in KNN, the critical factor is the number of nearest neighbors [23].…”

“…The SVM framework serves as an intersection between machine learning and embedded systems. SVM functions as both a linear and nonlinear classifier, acting as a mathematical function capable of distinguishing between two types of objects, categorized as classes [23]. The reason for utilizing the SVM algorithm is its efficient capability to differentiate between the characteristics of traffic flow in normal and abnormal scenarios [24].…”

“…RF is a supervised classification algorithm that constructs a random forest. The accuracy of the results improves with an increase in the number of trees in the forest [23]. In addition, during the training phase, RF builds numerous decision trees and provides an output based on the mode of classes (for classification) or the mean prediction (for regression) of the individual trees [24].…”